---
typeId: req
recordId: benac-trust-006
fields:
  title: Package approval
  statement: >-
    Benac shall define a package approval record.

    A package approval record shall bind package CID, selected package interface,
    descriptor snapshot CID or descriptor scope, invocation contract snapshot CID where
    relevant, allowed data classes, granted capability identifiers, denied capability
    identifiers where relevant, issuer principal, authentication context where relevant,
    expiry or revocation metadata where relevant, inspection result reference,
    validation report reference where available, fixture result references where relied
    upon, warnings presented, and evidence relied upon.

    A package approval record shall not approve capabilities that are not identified in
    the approval record.

    A package approval record shall not approve data classes that are not identified in
    the approval record.

    A package approval record shall not approve interfaces that are not identified in
    the approval record.

    A package approval record shall not approve descriptor scopes that are not
    identified in the approval record.

    A package approval record shall not approve invocation contracts that are not
    identified in the approval record.

    A package approval record shall not grant authority by package name, author name,
    file name, provider name, product name, model name, URL, package label, or
    human-readable description.

    A package approval record shall not rely on facts hidden from the referenced
    inspection result.

    A package approval record shall be enforceable only for the package CID, package
    interface, descriptor scope, invocation contract snapshot where relevant, allowed
    data classes, and granted capabilities recorded in the approval and corresponding
    trust decision.

    A package approval record shall not authorize a package operation when a required
    capability is missing, denied, expired, revoked, conflicted, unavailable, or not yet
    determined.

    A package approval record shall not authorize a package operation when the operation
    is not currently mediated by this Station.

    A package approval record shall not authorize a package operation when required
    artifacts are unavailable or resource requirements are not satisfied.
  rationale: >-
    Approval states what Local Policy allows for a package. Approval is scoped to exact
    package identity, selected interface authority, descriptor scope, invocation
    contract, data classes, capabilities, and evidence.
  verification: >-
    Tests approve packages with different declared capabilities using the same package
    approval record type. Tests verify that approval grants only the capabilities listed
    in the approval record. Tests verify that missing grants, denied capabilities,
    unavailable artifacts, unavailable resources, and operations not currently mediated
    by the Station block operation without changing package content identity.
  testable: true
  status: draft
  area: BENAC-TRUST
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Package approval and capability grants
  order: 87.07
---
